syzbot


assert failed: pmap->pm_obj[i].uo_npages == 0

Status: fixed on 2019/06/19 06:32
Reported-by: syzbot+e2729c9f8c2922897057@syzkaller.appspotmail.com
Fix commit: in uvm_map_protect(), do a pmap_update() before possibly switching from removing pmap entries to creating them. this fixes the problem reported in https://syzkaller.appspot.com/bug?id=cc89e47f05e4eea2fd69bcccb5e837f8d1ab4d60
First crash: 1882d, last: 1801d

Sample crash report:
[  33.7236060] panic: kernel diagnostic assertion "pmap->pm_obj[i].uo_npages == 0" failed: file "/syzkaller/managers/netbsd/kernel/sys/arch/x86/x86/pmap.c", line 2464 
[  33.7236060] cpu0: Begin traceback...
[  33.7236060] vpanic() at netbsd:vpanic+0x214
[  33.7350488] _GLOBAL__sub_D_65535_0_cpu_configure() at netbsd:_GLOBAL__sub_D_65535_0_cpu_configure
[  33.7350488] pmap_destroy() at netbsd:pmap_destroy+0x40d
[  33.7463794] pmap_pp_remove() at netbsd:pmap_pp_remove+0x876
[  33.7463794] uvm_anon_dispose() at netbsd:uvm_anon_dispose+0x179
[  33.7605841] uvm_anon_freelst() at netbsd:uvm_anon_freelst+0x48
[  33.7709199] amap_wipeout() at netbsd:amap_wipeout+0x237
[  33.7806778] uvm_unmap_detach() at netbsd:uvm_unmap_detach+0x8b
[  33.7934585] uvmspace_free() at netbsd:uvmspace_free+0x200
[  33.8032364] exit1() at netbsd:exit1+0x39d
[  33.8032364] sys_exit() at netbsd:sys_exit+0x6c
[  33.8162077] syscall() at netbsd:syscall+0x32e
[  33.8259746] --- syscall (number 1) ---
[  33.8259746] 7d493e6fe47a:
[  33.8259746] cpu0: End traceback...

[  33.8406363] dumping to dev 4,1 (offset=0, size=0): not possible
[  33.8406363] rebooting...
SeaBIOS (version 1.8.2-20190204_181744-google)
Total RAM Size = 0x00000001e0000000 = 7680 MiB
CPUs found: 2     Max CPUs supported: 2
found virtio-scsi at 0:3
virtio-scsi vendor='Google' product='PersistentDisk' rev='1' type=0 removable=0
virtio-scsi blksize=512 sectors=4194304 = 2048 MiB
drive 0x000f2a00: PCHS=0/0/0 translation=lba LCHS=520/128/63 s=4194304
Booting from Hard Disk 0...

>> NetBSD/x86 BIOS Boot, Revision 5.10 (Tue Jul 17 14:59:51 UTC 2018) (from NetBSD 8.0)
>> Memory: 639/3144640 k

     1. Boot normally
     2. Boot single user
     3. Disable ACPI
     4. Disable ACPI and SMP
     5. Drop to boot prompt
|/-\|/-39066448\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-+2876592\|/- [1062569\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/+1362192-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/+1043671-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-\|/-]=0x2b4f688
\|/-\|/-\|/-\|/-\|/-\|/-\|/-WARNING: couldn't open /var/db/entropy-file
WARNING: 1 module failed to load

Crashes (58):
Time Kernel Commit Syzkaller Config Log Report Syz repro C repro VM info Assets (help?) Manager Title
2019/03/01 18:45 netbsd 46b12d457099 68d9e495 console log report syz C ci2-netbsd
2019/05/21 03:12 netbsd aa2c9eca0f54 b5641f32 console log report ci2-netbsd
2019/05/20 15:34 netbsd aa2c9eca0f54 5a4461b0 console log report ci2-netbsd
2019/05/19 16:56 netbsd 66ae6081c50c 5a4461b0 console log report ci2-netbsd
2019/05/17 05:39 netbsd 0b24cb365185 7fb690f3 console log report ci2-netbsd
2019/05/13 07:32 netbsd e3ce2135817b 16ab1e89 console log report ci2-netbsd
2019/05/12 10:31 netbsd 308a4de880f8 c017728b console log report ci2-netbsd
2019/05/11 23:28 netbsd d2740109e7c1 0637a7f0 console log report ci2-netbsd
2019/05/09 21:25 netbsd 352e2fc1629a 214bf476 console log report ci2-netbsd
2019/05/05 03:22 netbsd b73a5df8f801 d28f4ce5 console log report ci2-netbsd
2019/05/04 23:22 netbsd b73a5df8f801 d28f4ce5 console log report ci2-netbsd
2019/05/01 12:00 netbsd fe3c80c3ed2d 618456b4 console log report ci2-netbsd
2019/04/29 03:47 netbsd 44d3b311756a b617407b console log report ci2-netbsd
2019/04/28 21:58 netbsd 44d3b311756a b617407b console log report ci2-netbsd
2019/04/26 21:05 netbsd 14d2bf09d91c b617407b console log report ci2-netbsd
2019/04/23 19:28 netbsd c108bd436ea1 2398edea console log report ci2-netbsd
2019/04/23 05:44 netbsd d3c02f29f4eb 53199d6e console log report ci2-netbsd
2019/04/18 08:03 netbsd 5af91eeb1225 b0e8efcb console log report ci2-netbsd
2019/04/15 07:07 netbsd e6d44f36484b 505ab413 console log report ci2-netbsd
2019/04/11 10:27 netbsd 0710e7fbeb51 e955ac50 console log report ci2-netbsd
2019/04/11 04:36 netbsd cfbf608c5bc0 e955ac50 console log report ci2-netbsd
2019/04/10 22:28 netbsd 467fc66daef1 65b612b7 console log report ci2-netbsd
2019/04/10 08:23 netbsd 675bb229a4bf 65b612b7 console log report ci2-netbsd
2019/04/10 05:44 netbsd a3063941bcec 65b612b7 console log report ci2-netbsd
2019/04/09 06:20 netbsd 1b93ab6a788b 995065ff console log report ci2-netbsd
2019/04/07 22:23 netbsd a10759f081a1 c34fde03 console log report ci2-netbsd
2019/04/06 12:55 netbsd c2452c62ad22 c34fde03 console log report ci2-netbsd
2019/04/04 08:44 netbsd 82ba9048de22 d6fc4177 console log report ci2-netbsd
2019/04/03 13:10 netbsd 4d21d7a4f238 dfd3394d console log report ci2-netbsd
2019/04/01 06:46 netbsd a5a5ed5ab169 ccf2355a console log report ci2-netbsd
2019/03/31 00:55 netbsd 589fd51724f2 0c624d4d console log report ci2-netbsd
2019/03/29 10:43 netbsd ce815d3feb61 e825006c console log report ci2-netbsd
2019/03/29 08:04 netbsd ce815d3feb61 e825006c console log report ci2-netbsd
2019/03/27 18:19 netbsd 01a4ec84dbfa 70d776a2 console log report ci2-netbsd
2019/03/26 07:30 netbsd e1c3c389d697 55684ce1 console log report ci2-netbsd
2019/03/25 11:32 netbsd 6eb76e802b22 2c86e0a5 console log report ci2-netbsd
2019/03/25 07:38 netbsd d2dd9e594dc9 2c86e0a5 console log report ci2-netbsd
2019/03/25 01:56 netbsd d2dd9e594dc9 2c86e0a5 console log report ci2-netbsd
2019/03/24 06:26 netbsd 326a04504535 a2cef203 console log report ci2-netbsd
2019/03/20 22:19 netbsd 6e79b7c8422e d4aacfdb console log report ci2-netbsd
2019/03/20 21:50 netbsd 6e79b7c8422e d4aacfdb console log report ci2-netbsd
2019/03/20 21:36 netbsd 6e79b7c8422e d4aacfdb console log report ci2-netbsd
2019/03/20 09:35 netbsd 8d01f317c9a1 2458c1c6 console log report ci2-netbsd
2019/03/20 02:41 netbsd 8d01f317c9a1 2458c1c6 console log report ci2-netbsd
2019/03/19 20:09 netbsd 21d6506aaa91 e4549234 console log report ci2-netbsd
2019/03/18 06:45 netbsd d0a7a1f7ea33 f8757044 console log report ci2-netbsd
2019/03/17 21:10 netbsd ec915cca8a77 ba18afea console log report ci2-netbsd
2019/03/17 00:21 netbsd 07e144121719 bab43553 console log report ci2-netbsd
2019/03/16 15:10 netbsd a171867f43ea bab43553 console log report ci2-netbsd
2019/03/16 02:28 netbsd 287b396b094e bab43553 console log report ci2-netbsd
2019/03/14 16:30 netbsd 5a30261ce359 d09a902e console log report ci2-netbsd
2019/03/13 04:09 netbsd 3853f16d7a18 2881fc25 console log report ci2-netbsd
2019/03/12 15:55 netbsd b0eb203687ca a71bfb62 console log report ci2-netbsd
2019/03/11 08:08 netbsd bfb2085108a3 12365b99 console log report ci2-netbsd
2019/03/09 06:44 netbsd 3ecbc4785bd9 12365b99 console log report ci2-netbsd
2019/03/08 17:45 netbsd 57a2d3217659 12365b99 console log report ci2-netbsd
2019/03/05 02:18 netbsd 8287ae29e052 7c693b52 console log report ci2-netbsd
2019/03/01 18:13 netbsd 46b12d457099 68d9e495 console log report ci2-netbsd
* Struck through repros no longer work on HEAD.